| 00:36.18 | *** join/#utah kendsnyder (~Adium@63.118.230.9) |
| 00:37.59 | *** join/#utah OldCoder (~OldCoder@unaffiliated/oldcoder) |
| 02:30.46 | *** join/#utah tiwula (~lane@74-81-251-156.static.logl001.digis.net) |
| 02:58.47 | *** join/#utah blunaxela (~alex@45.56.20.105) |
| 03:48.22 | *** join/#utah OldCoder (~OldCoder@unaffiliated/oldcoder) |
| 04:03.10 | *** join/#utah fadein (~Erik@c-76-23-32-157.hsd1.ut.comcast.net) |
| 04:34.01 | *** join/#utah HexaKhan (~HexaKha@216.51.24.180) |
| 06:55.32 | *** join/#utah ^Migs^ (~migs@205.122.50.108) |
| 08:40.44 | *** join/#utah olli (~olli@dslb-094-216-011-234.094.216.pools.vodafone-ip.de) |
| 11:29.30 | *** join/#utah olli (~olli@dslb-094-216-011-234.094.216.pools.vodafone-ip.de) |
| 13:03.36 | *** join/#utah wargasm (~wargasm@69.169.178.194) |
| 13:05.34 | *** join/#utah wargasm_ (~wargasm@69.169.178.194) |
| 13:15.01 | *** join/#utah jalbretsen (~jalbretse@sonic.itransact.com) |
| 13:46.12 | *** join/#utah fcodiaz (~fcodiaz@2001:420:3041:1320:d1a7:864c:79f4:3acd) |
| 14:09.45 | *** join/#utah T4rku5 (~T4rku5@unaffiliated/shunkydave) |
| 14:17.59 | *** join/#utah josephscott (~josephsco@192.0.67.251) |
| 14:28.57 | eightyeight | steve meyers hang out here? |
| 14:29.07 | eightyeight | from plug |
| 14:50.50 | *** join/#utah josephscott (~josephsco@192.0.67.251) |
| 14:52.02 | *** join/#utah tiwula (~lane@70.89.246.241-Busname-UT.hfc.comcastbusiness.net) |
| 14:55.59 | *** join/#utah davido_work (~doswald@216.50.142.194) |
| 14:57.08 | fozzmoo | eightyeight: Steve's nick is stevecoug |
| 14:57.28 | eightyeight | ~seen stevecoug |
| 14:57.33 | infobot | stevecoug <~stevecoug@oalug/member/stevecoug> was last seen on IRC in channel #uphpu, 70d 19h 4m 1s ago, saying: 'carmony: people are asking on the mailing list about the moderated jobs list queue'. |
| 14:57.44 | eightyeight | meh |
| 14:57.48 | eightyeight | i'll email him |
| 14:57.51 | eightyeight | thx fozzmoo |
| 14:59.53 | fozzmoo | np |
| 15:24.59 | *** join/#utah Olli_ (~olli@dslb-094-216-011-234.094.216.pools.vodafone-ip.de) |
| 15:30.17 | *** join/#utah siel (~siel@unaffiliated/motley) |
| 15:32.31 | *** join/#utah davido_work_ (~doswald@216.50.142.194) |
| 15:35.53 | *** join/#utah metacortex (~metacorte@193.105.134.246) |
| 15:44.19 | *** join/#utah evad4b (~b4dave@client175.mainstreamdata.com) |
| 15:50.53 | *** join/#utah wargasm (~wargasm@69.169.178.194) |
| 15:52.11 | *** join/#utah davido_work (~doswald@216.50.142.194) |
| 16:08.00 | asoc | Yea guys lets hook everything to the internet!!! |
| 16:08.10 | asoc | http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/ |
| 16:08.13 | eightyeight | CFRG@IETF93 meeting minutes: https://www.ietf.org/proceedings/93/minutes/minutes-93-cfrg |
| 16:08.23 | eightyeight | `Quynh Dang (NIST): SHA-3 was just signed off' |
| 16:08.25 | eightyeight | finally |
| 16:11.26 | Tod-Work | asoc, hooking things to the internet is fine and convenient. Doing so willy nilly is the issue. |
| 16:12.26 | asoc | Tod-Work: I agree. But it is the cool thing to do so it gets done willy nilly so often. |
| 16:12.57 | Tod-Work | doing things willy nilly in general is a problem these days |
| 16:13.12 | Tod-Work | We have learned nothing from centuries of engineering history |
| 16:15.54 | *** join/#utah wargasm (~wargasm@69.169.178.194) |
| 16:23.16 | RyanE | The issue in that particular case is they hooked the entertainment system (which pretty much needs a connection to the outside world to be useful) to the CANBUS on the car, without any kind of firewall or security as to what commands it can send. |
| 16:23.35 | RyanE | duh that someone broke the entertainment system, it shouldn't allow them to steer the car or cause it to speed up or slow down. |
| 16:23.49 | RyanE | or 99% of the other functionality on the CANBUS |
| 16:33.30 | *** join/#utah Olli_ (~olli@dslb-094-216-011-234.094.216.pools.vodafone-ip.de) |
| 16:34.05 | *** join/#utah josephscott (~josephsco@192.0.67.251) |
| 16:46.42 | *** join/#utah Natrinicle (~Natrinicl@natrinicle.com) |
| 16:47.17 | *** join/#utah wargasm (~wargasm@69.169.178.194) |
| 17:35.55 | *** join/#utah josephscott (~josephsco@192.0.67.251) |
| 17:44.27 | *** join/#utah josephscott (~josephsco@192.0.67.251) |
| 17:45.17 | *** join/#utah harleypig (sid15959@gateway/web/irccloud.com/x-nytinfbkjeyiitys) |
| 17:49.10 | *** join/#utah youtah (~youtah@166.70.79.226) |
| 17:49.28 | youtah | jima, apparently I have caused quite the stir with my Facebook post |
| 17:49.54 | jima | did you? it seemed pretty positive. |
| 17:50.09 | youtah | it's starting |
| 17:50.16 | youtah | some of the comments coming out are the |
| 17:50.32 | youtah | "repressed Utah, culture to blame" |
| 17:50.34 | youtah | type |
| 17:50.42 | youtah | It's starting to head that way |
| 17:50.53 | youtah | trying to figure out how to curb it before it spirals out of control |
| 17:51.38 | goozbach | youtah: the ashley madison post? |
| 17:51.47 | youtah | yeah |
| 17:51.55 | youtah | Did you read my post goozbach? |
| 17:52.01 | goozbach | yeah |
| 17:52.01 | youtah | Utah #1 in Porn |
| 17:52.07 | goozbach | and I'm offended! |
| 17:52.07 | youtah | #4 in Affairs online |
| 17:52.16 | youtah | Up there with drugs |
| 17:52.20 | youtah | lol, oh man! |
| 17:52.37 | goozbach | our culture WRT sex and sexuality is *BROKEN* |
| 17:52.42 | youtah | I was actually hoping to offend you and only you goozbach |
| 17:52.49 | goozbach | well good job! |
| 17:52.53 | youtah | Agreed goozbach |
| 17:52.55 | youtah | lol |
| 17:54.08 | *** join/#utah wargasm (~wargasm@69.169.178.194) |
| 17:54.12 | goozbach | porn addition is a real thing, and our "sex is bad, you need to cover yourself lest a boy get an impure thought" style teaching is only exasterbating (heh 'bating') the problem |
| 17:55.24 | programmerq | youtah: I've just accepted the fact that you like to stir the pot a bit. |
| 17:55.34 | programmerq | (not that it was hard for me to accept) |
| 17:58.30 | goozbach | meh it's been pretty balaned youtah |
| 17:59.04 | programmerq | it doesn't take much to stir up "trouble" where we live though. |
| 17:59.04 | *** join/#utah yukaia (~yukaia@74-81-251-245.static.logl001.digis.net) |
| 18:02.59 | youtah | "go away, baiting'!" |
| 18:03.02 | eightyeight | esp. on facebook |
| 18:03.08 | youtah | name that movie goozbach |
| 18:03.28 | youtah | agreed eightyeight |
| 18:03.32 | goozbach | normaly I'd be able to |
| 18:03.43 | goozbach | but I've been averaghing 3hrs of sleep for the last four weeks |
| 18:03.46 | goozbach | so I'm about fried |
| 18:03.47 | youtah | Idiocracy |
| 18:04.16 | youtah | it's when he is watching someone cut steak with a fork and knife with their feet on TV, lol |
| 18:04.33 | goozbach | hah that's right |
| 18:04.47 | youtah | "this isn't a good time to a latte " |
| 18:04.53 | youtah | or something like that |
| 18:04.58 | youtah | oh wait |
| 18:05.07 | youtah | it was "I don't think we have time to a latte" |
| 18:05.16 | youtah | s/to/for/ |
| 18:07.57 | *** join/#utah josephscott (~josephsco@192.0.67.251) |
| 18:18.23 | *** join/#utah wargasm (~wargasm@69.169.178.194) |
| 18:29.25 | *** join/#utah weedpatch2 (~weedpatch@unaffiliated/weedpatch2) |
| 18:43.40 | *** join/#utah youtah (~youtah@166.70.79.226) |
| 18:57.07 | *** join/#utah josephscott (~josephsco@192.0.67.251) |
| 19:00.24 | *** join/#utah wargasm (~wargasm@69.169.178.194) |
| 19:06.11 | *** join/#utah wargasm (~wargasm@69.169.178.194) |
| 19:06.26 | levi | RyanE: I'm pretty sure that a lot of the problem with car hacking stuff is that various functionality ends up getting farmed out to different tier-1 suppliers, which tends to make interfaces to things more open. And it's not really been a serious problem before, so getting things secure at the design level isn't properly specified to the tier-1s. |
| 19:11.10 | *** join/#utah Olli_ (~olli@dslb-094-216-011-234.094.216.pools.vodafone-ip.de) |
| 19:17.38 | *** join/#utah davido_work_ (~doswald@216.50.142.194) |
| 19:19.29 | Tod-Work | youtah, accept my love! |
| 19:35.12 | *** join/#utah youtah (~youtah@166.70.79.226) |
| 19:36.21 | youtah | Howdy Tod-Work |
| 19:36.27 | Tod-Work | Hi! |
| 19:36.31 | youtah | Just getting back from delicious lunch |
| 19:36.36 | youtah | catching up |
| 19:36.42 | youtah | lol, ah I see what you meant |
| 19:36.46 | youtah | by accept my love |
| 19:36.47 | youtah | lol |
| 19:36.58 | RyanE | levi: no doubt, it's an institutional organizational problem as much as anything. |
| 19:37.20 | Tod-Work | indeed, youtah. Indeed. |
| 19:39.07 | levi | RyanE: For example, the touchscreen head units for Jeep/Chrysler/Dodge all look and function very similarly, but some of them are manufactured by Harman Becker and some are manufactured by Mitsubishi Electronics. I have no idea how much of the software on them is in common, but I know it's common for some software modules to come from the automaker or other tier-1s. |
| 19:41.13 | levi | RyanE: You can apparently swap out the Mitsubishi ones for the Harman Becker ones and by having the dealer re-flash some ECU module parameters you can tell the car that it's got a different model installed. At that point the head unit will show the correct brand logo on boot up and be able to communicate with the rest of the car. |
| 19:41.30 | *** join/#utah youtah (~youtah@166.70.79.226) |
| 19:44.00 | RyanE | nice |
| 19:44.15 | RyanE | (other than the hacking part). |
| 19:44.24 | *** join/#utah youtah (~youtah@166.70.79.226) |
| 19:45.08 | levi | RyanE: It seems like the network connectivity is an add-on supplied (at least in part) by Sirius. |
| 19:45.08 | unum | http://www.politico.com/magazine/story/2015/07/free-range-kids-parents-mike-lee-120435.html?cmpid=sf#.Va_ya7xXbRZ |
| 19:45.36 | RyanE | regardless, I don't think the entertainment module needs full canbus access, so it really probably should have it. |
| 19:46.18 | bregalad | read only access :) |
| 19:46.48 | levi | CAN is not a very sophisticated protocol, though. As the tin says, it's a *bus* and anything written to a segment goes everywhere. |
| 19:48.10 | RyanE | yeah. I suspect the only way you could secure it would be a uC firewall that only sends certain commands. |
| 19:48.46 | levi | You can't really filter it without a repeater module, which is basically another microcontroller that reads from one bus segment and writes to another. |
| 19:49.00 | RyanE | exactly |
| 19:50.31 | levi | Someone probably didn't figure it was worth the extra expense (in additional hardware, software, cabling, etc.) to add such a thing to the system. |
| 19:51.15 | bregalad | but that person didn't think everyone in the world would start plugging in their phones :) |
| 19:53.36 | RyanE | that person was likely a contractor who is now working on something else for someone else. |
| 19:54.04 | *** join/#utah klysmoth (~Mdasoh@168.94.238.132) |
| 19:57.23 | levi | Probably not a contractor. It was probably a detail that was overlooked in the design process, which tends to be done almost entirely up-front and collaboratively between the manufacturer and tier-1s via shared specification documents. |
| 19:58.22 | levi | And it's started (and a lot of the high-level details frozen) years in advance of the first shipping units. |
| 19:58.46 | levi | It's a very different market from consumer electronics. |
| 20:04.12 | *** join/#utah tiwula (~lane@70.89.246.241-Busname-UT.hfc.comcastbusiness.net) |
| 20:10.13 | levi | Anyway, the exploit in the Wired article was not an easy one to develop. They had to spend a pretty big chunk of money to even get the information necessary to start the process. There was a whole lot of reverse engineering of hardware and software involved to find vulnerable code to exploit, and then a whole bunch more to find out how to interface with the existing hardware/software to do anything. It's not |
| 20:10.14 | levi | exactly standardized PC hardware, and although there are standardized elements, there's a *lot* that's custom. |
| 20:12.10 | *** join/#utah youtah (~youtah@166.70.79.226) |
| 20:13.08 | bregalad | levi: how hard do you think it would be to disable your car's GPS and mobile radios? |
| 20:16.10 | levi | The infotainment CPU is almost certainly running QNX, which has a POSIX security model. So you've got to find a vulnerability that gets you root access via some network code. You've got to figure out the custom mechanism for firmware reloading so you can upload your patched firmware and trigger it. Then you've got to figure out how to talk to the *other* MCU that's actually on the same board that has the CAN |
| 20:16.11 | levi | controller. It's probably running some AUTOSAR-compliant RTOS, and probably has some sort of shared bus with the host controller (SPI, probably?) and you've got to reverse engineer the code that talks to it. Then you've got to trace the CAN messages and figure out which addresses go to which modules and what the various messages mean. |
| 20:17.44 | levi | bregalad: GPS is not an attack vector. Disabling the mobile radio is most likely as easy as unplugging the antenna. |
| 20:18.44 | bregalad | levi: I don't care so much for remote attack vectors as tracking vectors :) |
| 20:19.59 | levi | bregalad: They can't track you without exploiting a remote attack vector first. Meanwhile, you have no nav system, which was the whole point of getting the fancy head unit in the first place. |
| 20:21.30 | levi | From what I can tell, the WiFi gateway feature is an add-on module that you have to specifically purchase and then enable via contract with Sirius. So really, you just have to not pay for it to disable it. |
| 20:22.27 | bregalad | levi: whatever made my car is going to track me indiscriminately |
| 20:22.48 | bregalad | I'm sure they'll build that in by default, no exploit necessary |
| 20:23.36 | levi | You should probably just not buy a car with a built-in nav system if you're going to be paranoid. |
| 20:23.56 | bregalad | I wonder how long that is going to even be an option |
| 20:24.53 | levi | Nav systems are certainly getting to be more common, but there's always the used car market. |
| 20:25.03 | bregalad | gmail was probably the most lucrative investment google ever made, I can't imagine a car maker to pass up a similar opportunity 10 years later |
| 20:25.26 | levi | Uh. |
| 20:27.54 | levi | Google is a company that exists to put ads in front of eyeballs. It always has been. Car makers exist to... make and sell cars. |
| 20:28.49 | bregalad | I would say that car makers exist to attempt to exert control over the aftermarket |
| 20:28.57 | bregalad | and lately consumer data market |
| 20:29.44 | levi | Why would you say that? Those are clearly secondary concerns. |
| 20:30.08 | levi | There is no "aftermarket" without the making and selling of cars. |
| 20:30.31 | levi | Consumer data is gathered in order to direct the making and selling of cars. |
| 20:30.53 | bregalad | it's an irresistable temptation for any business to build and prioritize continuous revenue streams over one time sales |
| 20:31.18 | bregalad | at least that has been the groupthink for the past 30 years |
| 20:32.15 | RyanE | Yeah, but they do it in stupid ways. Pretty sure carmakers would make more on GPS updates if they didn't cost 4x as much as buying an aftermarket GPS... |
| 20:32.33 | RyanE | BMW-owning friends say the GPS update costs $300. |
| 20:32.59 | bregalad | 'let your money work for you' etc. |
| 20:33.21 | RyanE | then again, maybe my BMW-owning friends are not as rich as most BMW owners... :) |
| 20:33.44 | bregalad | RyanE: or they're not as good at projecting false wealth |
| 20:33.48 | bregalad | :) |
| 20:33.56 | RyanE | I think you're more likely to be tracked by a company that has some self-interest in knowing how you drive, like the OBD-II modules insurance companies give you discounts if you use... |
| 20:34.23 | RyanE | which they then can use in an accident with it's built-in accelerometer and access to speed data to see if you're at fault. |
| 20:36.24 | RyanE | pretty soon, they'll also want an app on your phone, so they can see if you're using it when the crash happens... "crash selfies". |
| 20:36.34 | *** join/#utah josephscott (~josephsco@192.0.67.251) |
| 20:38.49 | levi | bregalad: Automakers already have a continuous revenue stream. It's called selling and leasing cars. Especially leasing. And landing fleet purchase/lease contracts with rental companies, etc. |
| 20:39.43 | levi | There is a business world outside of the bizarre computer/software market. |
| 20:40.00 | bregalad | levi: nowai, my worldview is completely correct |
| 20:41.33 | levi | Automakers also tend to be behemoths and well-established, meaning that they don't change their ways very swiftly. |
| 20:42.08 | levi | It's a very difficult market to break into and shake up. |
| 20:49.49 | *** join/#utah youtah (~youtah@100.sub-70-208-4.myvzw.com) |
| 21:11.20 | *** join/#utah tiwula (~lane@70.89.246.241-Busname-UT.hfc.comcastbusiness.net) |
| 21:14.09 | *** join/#utah blunaxela (~alex@128.187.221.202) |
| 21:26.27 | *** join/#utah youtah (~youtah@100.sub-70-208-4.myvzw.com) |
| 21:34.14 | *** join/#utah davido_work_ (~doswald@216.50.142.194) |
| 21:45.57 | *** join/#utah youtah (~youtah@100.sub-70-208-4.myvzw.com) |
| 21:50.15 | *** join/#utah evad4b (~b4dave@67.41.236.62) |
| 21:52.44 | *** join/#utah davido_work (~doswald@216.50.142.194) |
| 21:54.51 | *** join/#utah josephscott (~josephsco@192.0.67.251) |
| 22:00.50 | *** join/#utah klysmoth (~Mdasoh@173-14-238-114-Utah.hfc.comcastbusiness.net) |
| 22:01.58 | *** join/#utah youtah (~youtah@100.sub-70-208-4.myvzw.com) |
| 22:02.42 | youtah | Uhg |
| 22:02.54 | youtah | this CenturyLink fiber outrage is killing us |
| 22:09.56 | eightyeight | i love how centos 6 kickstart files are not compatible with centos 7 |
| 22:09.58 | eightyeight | win |
| 22:11.03 | bregalad | I love how redhat configs are not standardized and change between major releases |
| 22:11.29 | eightyeight | red hat? standards? surely, you jest. |
| 22:15.05 | programmerq | isn't a major version what you do when you have breaking changes? |
| 22:15.26 | programmerq | but I do agree that it would be nice if I could drop in a kickstart config from 6 and have 7 deal with it. |
| 22:15.34 | eightyeight | i have yet to see a debian 5 preseed file not work on later versions |
| 22:27.42 | jalbretsen | eightyeight: Are these the ones that do or do not honor the SELinux setting? That seems to break every other release. |
| 22:28.01 | eightyeight | nope. nothing selinux related |
| 22:28.10 | eightyeight | purely kickstart syntax changes |
| 22:28.41 | jalbretsen | no no no |
| 22:28.43 | jalbretsen | what I mean is |
| 22:28.56 | jalbretsen | I have: "selinux --disabled" in my kickstart file |
| 22:29.08 | jalbretsen | install.... reboot.... guess what, SELinux enabled |
| 22:29.58 | eightyeight | no. that's not what i'm addressing |
| 22:30.35 | eightyeight | things like 'interactive' no longer functional. requiring '%end', and other things |
| 22:30.47 | jalbretsen | they fix that issues in one .X release, then it breaks again in the next. So I'm just jesting if that is in a version that works or not |
| 22:31.11 | jalbretsen | maybe the funny was too much of a tangent :) |
| 22:31.17 | jalbretsen | ah |
| 22:31.41 | *** join/#utah fcodiaz (~fcodiaz@adsl-72-152-235-63.asm.bellsouth.net) |
| 22:42.26 | *** part/#utah aarobc (~aarobc@2001:19f0:6400:81e1::64) |
| 23:36.36 | *** join/#utah inovent (inovent@c-24-11-62-201.hsd1.ut.comcast.net) |
| 23:39.38 | *** join/#utah youtah (~youtah@166.70.79.226) |